What a website plan should include for a service business

A one-time build ends at launch. The business receives a finished site and becomes responsible for keeping it running, current and secure. A website plan is an ongoing agreement where a provider keeps the site hosted, patched, backed up, measured and updated for a recurring fee.

The difference matters because a website is software. The server, the code, the plugins, the browsers that display it and the search engines that read it all change over time. A site that worked well on launch day can slow down, break a form or fall out of date within months if nobody is assigned to watch it.

For a service business, the website is often where a customer checks hours, reads about services, looks for a phone number and decides whether to book. A plan exists to keep those basics working without the owner having to manage them.

Hosting is where the site lives. A plan should name the hosting provider, state whether the site shares a server with other sites, and include an SSL certificate so the site loads over https. It should also describe uptime monitoring: who gets alerted when the site goes down, and how quickly someone responds.

Security updates are the part most often skipped. Patchstack's State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42 percent increase over 2024. The same report found 91 percent of those vulnerabilities were in plugins and 9 percent in themes, with only 6 reported in WordPress core. It also found that about half of high-impact vulnerabilities were exploited within 24 hours. A site that is not updated on a schedule is exposed for longer than it needs to be.

Backups should be automatic, stored somewhere other than the server the site runs on, and tested. Ask how many days of backups are kept and how long a full restore takes.

• Named hosting provider and server type
• SSL certificate included and renewed automatically
• Uptime monitoring with a stated response time
• Core, theme and plugin updates on a set schedule
• Daily off-site backups with a stated retention period
• A tested restore process

Speed should be measured, not described. Google publishes three Core Web Vitals on web.dev: Largest Contentful Paint, which should be 2.5 seconds or less; Interaction to Next Paint, which should be 200 milliseconds or less; and Cumulative Layout Shift, which should be 0.1 or less. Google assesses these at the 75th percentile of page loads, separately for mobile and desktop.

Mobile performance deserves equal weight. StatCounter's platform data for the United States shows mobile devices accounted for 49.1 percent of web traffic in September 2026, with desktop at 48.47 percent and tablets at 2.42 percent. A plan should include regular checks of all three Core Web Vitals on mobile and desktop, and a commitment to fix pages that fall outside the thresholds.

Yes. The U.S. Department of Justice guidance on web accessibility, published on ADA.gov in March 2022, states that businesses open to the public are covered by Title III of the Americans with Disabilities Act and that the Department's position is that these requirements apply to goods and services offered on the web.

Most sites have work to do. The WebAIM Million report for 2026, which tests the home pages of one million websites, detected WCAG failures on 95.9 percent of them, with an average of 56.1 errors per page. The most common issues were low contrast text (83.9 percent of home pages), missing image alternative text (53.1 percent) and missing form input labels (51 percent).

Each of those issues is fixable, and each can come back when new pages, images or forms are added. A plan should include an accessibility check whenever content changes and a periodic full review.

Content should change whenever the business changes: new services, new hours, new team members, new locations, updated policies. The cost of stale information is measurable. In BrightLocal's 2019 survey of 500 U.S. consumers, 50 percent said out-of-date contact information on a local business website would deter them from using that business. The same survey found 56 percent of consumers expect a business's own website to have the most accurate contact information, ahead of Google listings and directories.

A plan should state how change requests are submitted, how many are included each month, and how quickly a typical change is completed. Small edits such as hours or a phone number should be measured in hours or a business day, not weeks.

A useful report is short and answers four questions: Was the site up? Was it updated and backed up? How did it perform? What did visitors do?

In practice that means uptime for the month, the updates applied, backup status, Core Web Vitals results, visitor counts by source, and the actions that matter to a service business, such as calls from the site, form submissions and bookings. A report that lists traffic alone does not show whether the site is producing customers.

Ownership terms belong in writing before any work starts. The domain should be registered in the business's name. Under ICANN's Transfer Policy, a registrar must provide the authorization code needed to move a domain within five calendar days of a request if the registrant cannot generate it themselves, so the business should know which account holds the domain and how to reach it.

The site's content and design need the same clarity. The U.S. Copyright Office's Circular 30, revised in 2024, explains that work commissioned from someone who is not an employee is only a work made for hire when it fits specific categories and the parties sign a written agreement saying so. Otherwise the creator generally owns the copyright. A plan should include a signed assignment of rights to the business for the content, images and design produced for it, and should state how the business receives its files and data if it ever needs them.

Use the list below when reading any website plan proposal. If an item is missing, ask for it in writing.

• Domain registered in the business's name, with account access
• Hosting, SSL and uptime monitoring described
• Update schedule for core software, themes and plugins
• Off-site daily backups and a tested restore
• Core Web Vitals checked on mobile and desktop
• Accessibility checks when content changes
• Change request process and turnaround times
• Monthly report with calls, forms and bookings
• Written assignment of rights to content and design